From: Victor Julien Date: Mon, 12 Dec 2016 19:00:26 +0000 (+0100) Subject: detect: detect engine registration cleanup X-Git-Tag: suricata-4.0.0-beta1~372 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8bd14229486b60d5bd3fea4f92b47c515600d86c;p=thirdparty%2Fsuricata.git detect: detect engine registration cleanup --- diff --git a/src/detect-app-layer-event.c b/src/detect-app-layer-event.c index ec31ea4b85..a4207899f4 100644 --- a/src/detect-app-layer-event.c +++ b/src/detect-app-layer-event.c @@ -78,10 +78,10 @@ void DetectAppLayerEventRegister(void) sigmatch_table[DETECT_AL_APP_LAYER_EVENT].RegisterTests = DetectAppLayerEventRegisterTests; - DetectAppLayerInspectEngineRegister2("app-layer-events", + DetectAppLayerInspectEngineRegister("app-layer-events", ALPROTO_UNKNOWN, SIG_FLAG_TOSERVER, DetectEngineAptEventInspect); - DetectAppLayerInspectEngineRegister2("app-layer-events", + DetectAppLayerInspectEngineRegister("app-layer-events", ALPROTO_UNKNOWN, SIG_FLAG_TOCLIENT, DetectEngineAptEventInspect); diff --git a/src/detect-cipservice.c b/src/detect-cipservice.c index 8a6d61b904..1074241d5a 100644 --- a/src/detect-cipservice.c +++ b/src/detect-cipservice.c @@ -59,10 +59,10 @@ void DetectCipServiceRegister(void) sigmatch_table[DETECT_CIPSERVICE].RegisterTests = DetectCipServiceRegisterTests; - DetectAppLayerInspectEngineRegister2("cip", + DetectAppLayerInspectEngineRegister("cip", ALPROTO_ENIP, SIG_FLAG_TOSERVER, DetectEngineInspectCIP); - DetectAppLayerInspectEngineRegister2("cip", + DetectAppLayerInspectEngineRegister("cip", ALPROTO_ENIP, SIG_FLAG_TOCLIENT, DetectEngineInspectCIP); @@ -321,10 +321,10 @@ void DetectEnipCommandRegister(void) sigmatch_table[DETECT_ENIPCOMMAND].RegisterTests = DetectEnipCommandRegisterTests; - DetectAppLayerInspectEngineRegister2("enip", + DetectAppLayerInspectEngineRegister("enip", ALPROTO_ENIP, SIG_FLAG_TOSERVER, DetectEngineInspectENIP); - DetectAppLayerInspectEngineRegister2("enip", + DetectAppLayerInspectEngineRegister("enip", ALPROTO_ENIP, SIG_FLAG_TOCLIENT, DetectEngineInspectENIP); diff --git a/src/detect-dnp3.c b/src/detect-dnp3.c index 6c868a5f21..438c38cb3a 100644 --- a/src/detect-dnp3.c +++ b/src/detect-dnp3.c @@ -549,10 +549,10 @@ static void DetectDNP3DataRegister(void) sigmatch_table[DETECT_AL_DNP3DATA].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_AL_DNP3DATA].flags |= SIGMATCH_PAYLOAD; - DetectAppLayerInspectEngineRegister2("dnp3_data", + DetectAppLayerInspectEngineRegister("dnp3_data", ALPROTO_DNP3, SIG_FLAG_TOSERVER, DetectEngineInspectDNP3Data); - DetectAppLayerInspectEngineRegister2("dnp3_data", + DetectAppLayerInspectEngineRegister("dnp3_data", ALPROTO_DNP3, SIG_FLAG_TOCLIENT, DetectEngineInspectDNP3Data); @@ -569,10 +569,10 @@ void DetectDNP3Register(void) DetectDNP3ObjRegister(); /* Register the list of func, ind and obj. */ - DetectAppLayerInspectEngineRegister2("dnp3", + DetectAppLayerInspectEngineRegister("dnp3", ALPROTO_DNP3, SIG_FLAG_TOSERVER, DetectEngineInspectDNP3); - DetectAppLayerInspectEngineRegister2("dnp3", + DetectAppLayerInspectEngineRegister("dnp3", ALPROTO_DNP3, SIG_FLAG_TOCLIENT, DetectEngineInspectDNP3); diff --git a/src/detect-dns-query.c b/src/detect-dns-query.c index 573f021f9a..c8f9690b47 100644 --- a/src/detect-dns-query.c +++ b/src/detect-dns-query.c @@ -81,7 +81,7 @@ void DetectDnsQueryRegister (void) DetectAppLayerMpmRegister("dns_query", SIG_FLAG_TOSERVER, 2, PrefilterTxDnsQueryRegister); - DetectAppLayerInspectEngineRegister2("dns_query", + DetectAppLayerInspectEngineRegister("dns_query", ALPROTO_DNS, SIG_FLAG_TOSERVER, DetectEngineInspectDnsQueryName); @@ -91,10 +91,10 @@ void DetectDnsQueryRegister (void) g_dns_query_buffer_id = DetectBufferTypeGetByName("dns_query"); /* register these generic engines from here for now */ - DetectAppLayerInspectEngineRegister2("dns_request", + DetectAppLayerInspectEngineRegister("dns_request", ALPROTO_DNS, SIG_FLAG_TOSERVER, DetectEngineInspectDnsRequest); - DetectAppLayerInspectEngineRegister2("dns_response", + DetectAppLayerInspectEngineRegister("dns_response", ALPROTO_DNS, SIG_FLAG_TOCLIENT, DetectEngineInspectDnsResponse); diff --git a/src/detect-engine.c b/src/detect-engine.c index 8fc6fb766c..c19d3f0ef8 100644 --- a/src/detect-engine.c +++ b/src/detect-engine.c @@ -101,14 +101,16 @@ static uint32_t DetectEngineTentantGetIdFromPcap(const void *ctx, const Packet * static DetectEngineAppInspectionEngine *g_app_inspect_engines = NULL; -void DetectAppLayerInspectEngineRegister(AppProto alproto, - uint32_t dir, int32_t sm_list, InspectEngineFuncPtr Callback) +void DetectAppLayerInspectEngineRegister(const char *name, + AppProto alproto, uint32_t dir, InspectEngineFuncPtr Callback) { - const int nlists = DetectBufferTypeMaxId(); + DetectBufferTypeRegister(name); + int sm_list = DetectBufferTypeGetByName(name); + BUG_ON(sm_list == -1); if ((alproto >= ALPROTO_FAILED) || (!(dir == SIG_FLAG_TOSERVER || dir == SIG_FLAG_TOCLIENT)) || - (sm_list < DETECT_SM_LIST_MATCH || sm_list >= nlists) || + (sm_list < DETECT_SM_LIST_MATCH) || (Callback == NULL)) { SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid arguments"); @@ -144,15 +146,6 @@ void DetectAppLayerInspectEngineRegister(AppProto alproto, } } -void DetectAppLayerInspectEngineRegister2(const char *name, - AppProto alproto, uint32_t dir, InspectEngineFuncPtr Callback) -{ - DetectBufferTypeRegister(name); - int sm_list = DetectBufferTypeGetByName(name); - BUG_ON(sm_list == -1); - DetectAppLayerInspectEngineRegister(alproto, dir, sm_list, Callback); -} - int DetectEngineAppInspectionEngine2Signature(Signature *s) { const int nlists = DetectBufferTypeMaxId(); diff --git a/src/detect-engine.h b/src/detect-engine.h index ada68647a9..a29db7a564 100644 --- a/src/detect-engine.h +++ b/src/detect-engine.h @@ -97,16 +97,13 @@ int DetectEngineInspectGenericList(ThreadVars *, const DetectEngineCtx *, /** * \brief Registers an app inspection engine. * + * \param name Name of the detection list * \param alproto App layer protocol for which we will register the engine. * \param direction The direction for the engine: SIG_FLAG_TOSERVER or * SIG_FLAG_TOCLIENT - * \param sm_list The SigMatch list against which the engine works. * \param Callback The engine callback. */ -void DetectAppLayerInspectEngineRegister(AppProto alproto, - uint32_t dir, int32_t sm_list, InspectEngineFuncPtr Callback); - -void DetectAppLayerInspectEngineRegister2(const char *name, +void DetectAppLayerInspectEngineRegister(const char *name, AppProto alproto, uint32_t dir, InspectEngineFuncPtr Callback); int DetectEngineAppInspectionEngine2Signature(Signature *s); diff --git a/src/detect-file-data.c b/src/detect-file-data.c index e9a4a14b94..ef245f9152 100644 --- a/src/detect-file-data.c +++ b/src/detect-file-data.c @@ -71,10 +71,10 @@ void DetectFiledataRegister(void) DetectAppLayerMpmRegister("file_data", SIG_FLAG_TOCLIENT, 2, PrefilterTxHttpResponseBodyRegister); - DetectAppLayerInspectEngineRegister2("file_data", + DetectAppLayerInspectEngineRegister("file_data", ALPROTO_HTTP, SIG_FLAG_TOCLIENT, DetectEngineInspectHttpServerBody); - DetectAppLayerInspectEngineRegister2("file_data", + DetectAppLayerInspectEngineRegister("file_data", ALPROTO_SMTP, SIG_FLAG_TOSERVER, DetectEngineInspectSMTPFiledata); diff --git a/src/detect-filename.c b/src/detect-filename.c index 1b59519fb9..67b386b2f7 100644 --- a/src/detect-filename.c +++ b/src/detect-filename.c @@ -72,14 +72,14 @@ void DetectFilenameRegister(void) sigmatch_table[DETECT_FILENAME].Free = DetectFilenameFree; sigmatch_table[DETECT_FILENAME].RegisterTests = DetectFilenameRegisterTests; - DetectAppLayerInspectEngineRegister2("files", + DetectAppLayerInspectEngineRegister("files", ALPROTO_HTTP, SIG_FLAG_TOSERVER, DetectFileInspectHttp); - DetectAppLayerInspectEngineRegister2("files", + DetectAppLayerInspectEngineRegister("files", ALPROTO_HTTP, SIG_FLAG_TOCLIENT, DetectFileInspectHttp); - DetectAppLayerInspectEngineRegister2("files", + DetectAppLayerInspectEngineRegister("files", ALPROTO_SMTP, SIG_FLAG_TOSERVER, DetectFileInspectSmtp); diff --git a/src/detect-http-client-body.c b/src/detect-http-client-body.c index 9ec6be6d39..2273aefbae 100644 --- a/src/detect-http-client-body.c +++ b/src/detect-http-client-body.c @@ -84,7 +84,7 @@ void DetectHttpClientBodyRegister(void) DetectAppLayerMpmRegister("http_client_body", SIG_FLAG_TOSERVER, 2, PrefilterTxHttpRequestBodyRegister); - DetectAppLayerInspectEngineRegister2("http_client_body", + DetectAppLayerInspectEngineRegister("http_client_body", ALPROTO_HTTP, SIG_FLAG_TOSERVER, DetectEngineInspectHttpClientBody); diff --git a/src/detect-http-cookie.c b/src/detect-http-cookie.c index 1cc61fe817..2b0baeaa21 100644 --- a/src/detect-http-cookie.c +++ b/src/detect-http-cookie.c @@ -89,10 +89,10 @@ void DetectHttpCookieRegister(void) DetectAppLayerMpmRegister("http_cookie", SIG_FLAG_TOCLIENT, 2, PrefilterTxResponseCookieRegister); - DetectAppLayerInspectEngineRegister2("http_cookie", + DetectAppLayerInspectEngineRegister("http_cookie", ALPROTO_HTTP, SIG_FLAG_TOSERVER, DetectEngineInspectHttpCookie); - DetectAppLayerInspectEngineRegister2("http_cookie", + DetectAppLayerInspectEngineRegister("http_cookie", ALPROTO_HTTP, SIG_FLAG_TOCLIENT, DetectEngineInspectHttpCookie); diff --git a/src/detect-http-header.c b/src/detect-http-header.c index 55a248b142..b2696463e4 100644 --- a/src/detect-http-header.c +++ b/src/detect-http-header.c @@ -88,10 +88,10 @@ void DetectHttpHeaderRegister(void) DetectAppLayerMpmRegister("http_header", SIG_FLAG_TOCLIENT, 2, PrefilterTxHttpResponseHeadersRegister); - DetectAppLayerInspectEngineRegister2("http_header", + DetectAppLayerInspectEngineRegister("http_header", ALPROTO_HTTP, SIG_FLAG_TOSERVER, DetectEngineInspectHttpHeader); - DetectAppLayerInspectEngineRegister2("http_header", + DetectAppLayerInspectEngineRegister("http_header", ALPROTO_HTTP, SIG_FLAG_TOCLIENT, DetectEngineInspectHttpHeader); diff --git a/src/detect-http-hh.c b/src/detect-http-hh.c index 5e51c7cba9..7c943d07d6 100644 --- a/src/detect-http-hh.c +++ b/src/detect-http-hh.c @@ -85,7 +85,7 @@ void DetectHttpHHRegister(void) DetectAppLayerMpmRegister("http_host", SIG_FLAG_TOSERVER, 2, PrefilterTxHostnameRegister); - DetectAppLayerInspectEngineRegister2("http_host", + DetectAppLayerInspectEngineRegister("http_host", ALPROTO_HTTP, SIG_FLAG_TOSERVER, DetectEngineInspectHttpHH); diff --git a/src/detect-http-hrh.c b/src/detect-http-hrh.c index 439eaef785..92f504e566 100644 --- a/src/detect-http-hrh.c +++ b/src/detect-http-hrh.c @@ -84,7 +84,7 @@ void DetectHttpHRHRegister(void) DetectAppLayerMpmRegister("http_raw_host", SIG_FLAG_TOSERVER, 2, PrefilterTxHostnameRawRegister); - DetectAppLayerInspectEngineRegister2("http_raw_host", + DetectAppLayerInspectEngineRegister("http_raw_host", ALPROTO_HTTP, SIG_FLAG_TOSERVER, DetectEngineInspectHttpHRH); diff --git a/src/detect-http-method.c b/src/detect-http-method.c index 3fa059cb77..0cf00f9bcd 100644 --- a/src/detect-http-method.c +++ b/src/detect-http-method.c @@ -86,7 +86,7 @@ void DetectHttpMethodRegister(void) DetectAppLayerMpmRegister("http_method", SIG_FLAG_TOSERVER, 4, PrefilterTxMethodRegister); - DetectAppLayerInspectEngineRegister2("http_method", + DetectAppLayerInspectEngineRegister("http_method", ALPROTO_HTTP, SIG_FLAG_TOSERVER, DetectEngineInspectHttpMethod); diff --git a/src/detect-http-raw-header.c b/src/detect-http-raw-header.c index b1a03254d7..35b9d3ad62 100644 --- a/src/detect-http-raw-header.c +++ b/src/detect-http-raw-header.c @@ -87,10 +87,10 @@ void DetectHttpRawHeaderRegister(void) DetectAppLayerMpmRegister("http_raw_header", SIG_FLAG_TOCLIENT, 2, PrefilterTxResponseHeadersRawRegister); - DetectAppLayerInspectEngineRegister2("http_raw_header", + DetectAppLayerInspectEngineRegister("http_raw_header", ALPROTO_HTTP, SIG_FLAG_TOSERVER, DetectEngineInspectHttpRawHeader); - DetectAppLayerInspectEngineRegister2("http_raw_header", + DetectAppLayerInspectEngineRegister("http_raw_header", ALPROTO_HTTP, SIG_FLAG_TOCLIENT, DetectEngineInspectHttpRawHeader); diff --git a/src/detect-http-raw-uri.c b/src/detect-http-raw-uri.c index 29f2c69308..080586e428 100644 --- a/src/detect-http-raw-uri.c +++ b/src/detect-http-raw-uri.c @@ -79,7 +79,7 @@ void DetectHttpRawUriRegister(void) DetectAppLayerMpmRegister("http_raw_uri", SIG_FLAG_TOSERVER, 2, PrefilterTxRawUriRegister); - DetectAppLayerInspectEngineRegister2("http_raw_uri", + DetectAppLayerInspectEngineRegister("http_raw_uri", ALPROTO_HTTP, SIG_FLAG_TOSERVER, DetectEngineInspectHttpRawUri); diff --git a/src/detect-http-request-line.c b/src/detect-http-request-line.c index 15516f37be..7c8cd3082e 100644 --- a/src/detect-http-request-line.c +++ b/src/detect-http-request-line.c @@ -89,7 +89,7 @@ void DetectHttpRequestLineRegister(void) DetectAppLayerMpmRegister("http_request_line", SIG_FLAG_TOSERVER, 2, PrefilterTxHttpRequestLineRegister); - DetectAppLayerInspectEngineRegister2("http_request_line", + DetectAppLayerInspectEngineRegister("http_request_line", ALPROTO_HTTP, SIG_FLAG_TOSERVER, DetectEngineInspectHttpRequestLine); diff --git a/src/detect-http-response-line.c b/src/detect-http-response-line.c index c798e35bb4..f7dd062faa 100644 --- a/src/detect-http-response-line.c +++ b/src/detect-http-response-line.c @@ -89,7 +89,7 @@ void DetectHttpResponseLineRegister(void) DetectAppLayerMpmRegister("http_response_line", SIG_FLAG_TOCLIENT, 2, PrefilterTxHttpResponseLineRegister); - DetectAppLayerInspectEngineRegister2("http_response_line", + DetectAppLayerInspectEngineRegister("http_response_line", ALPROTO_HTTP, SIG_FLAG_TOCLIENT, DetectEngineInspectHttpResponseLine); diff --git a/src/detect-http-stat-code.c b/src/detect-http-stat-code.c index 8a3b4d4b6e..938ce6e5f9 100644 --- a/src/detect-http-stat-code.c +++ b/src/detect-http-stat-code.c @@ -88,7 +88,7 @@ void DetectHttpStatCodeRegister (void) DetectAppLayerMpmRegister("http_stat_code", SIG_FLAG_TOCLIENT, 4, PrefilterTxHttpStatCodeRegister); - DetectAppLayerInspectEngineRegister2("http_stat_code", + DetectAppLayerInspectEngineRegister("http_stat_code", ALPROTO_HTTP, SIG_FLAG_TOCLIENT, DetectEngineInspectHttpStatCode); diff --git a/src/detect-http-stat-msg.c b/src/detect-http-stat-msg.c index d3a916c2b7..57dffbf807 100644 --- a/src/detect-http-stat-msg.c +++ b/src/detect-http-stat-msg.c @@ -88,7 +88,7 @@ void DetectHttpStatMsgRegister (void) DetectAppLayerMpmRegister("http_stat_msg", SIG_FLAG_TOCLIENT, 3, PrefilterTxHttpStatMsgRegister); - DetectAppLayerInspectEngineRegister2("http_stat_msg", + DetectAppLayerInspectEngineRegister("http_stat_msg", ALPROTO_HTTP, SIG_FLAG_TOCLIENT, DetectEngineInspectHttpStatMsg); diff --git a/src/detect-http-ua.c b/src/detect-http-ua.c index 5e0824dab7..b154806f39 100644 --- a/src/detect-http-ua.c +++ b/src/detect-http-ua.c @@ -85,7 +85,7 @@ void DetectHttpUARegister(void) DetectAppLayerMpmRegister("http_user_agent", SIG_FLAG_TOSERVER, 2, PrefilterTxUARegister); - DetectAppLayerInspectEngineRegister2("http_user_agent", + DetectAppLayerInspectEngineRegister("http_user_agent", ALPROTO_HTTP, SIG_FLAG_TOSERVER, DetectEngineInspectHttpUA); diff --git a/src/detect-http-uri.c b/src/detect-http-uri.c index 45acf4a7db..3ae8f866eb 100644 --- a/src/detect-http-uri.c +++ b/src/detect-http-uri.c @@ -81,7 +81,7 @@ void DetectHttpUriRegister (void) DetectAppLayerMpmRegister("http_uri", SIG_FLAG_TOSERVER, 2, PrefilterTxUriRegister); - DetectAppLayerInspectEngineRegister2("http_uri", ALPROTO_HTTP, SIG_FLAG_TOSERVER, + DetectAppLayerInspectEngineRegister("http_uri", ALPROTO_HTTP, SIG_FLAG_TOSERVER, DetectEngineInspectHttpUri); DetectBufferTypeSetDescriptionByName("http_uri", diff --git a/src/detect-modbus.c b/src/detect-modbus.c index 82600c909a..56717c475c 100644 --- a/src/detect-modbus.c +++ b/src/detect-modbus.c @@ -417,10 +417,10 @@ void DetectModbusRegister(void) DetectSetupParseRegexes(PARSE_REGEX_ACCESS, &access_parse_regex, &access_parse_regex_study); - DetectAppLayerInspectEngineRegister2("modbus", + DetectAppLayerInspectEngineRegister("modbus", ALPROTO_MODBUS, SIG_FLAG_TOSERVER, DetectEngineInspectModbus); - DetectAppLayerInspectEngineRegister2("modbus", + DetectAppLayerInspectEngineRegister("modbus", ALPROTO_MODBUS, SIG_FLAG_TOCLIENT, DetectEngineInspectModbus); diff --git a/src/detect-template-buffer.c b/src/detect-template-buffer.c index 929153fd09..d3838a0490 100644 --- a/src/detect-template-buffer.c +++ b/src/detect-template-buffer.c @@ -59,10 +59,10 @@ void DetectTemplateBufferRegister(void) sigmatch_table[DETECT_AL_TEMPLATE_BUFFER].flags |= SIGMATCH_PAYLOAD; /* register inspect engines */ - DetectAppLayerInspectEngineRegister2("template_buffer", + DetectAppLayerInspectEngineRegister("template_buffer", ALPROTO_TEMPLATE, SIG_FLAG_TOSERVER, DetectEngineInspectTemplateBuffer); - DetectAppLayerInspectEngineRegister2("template_buffer", + DetectAppLayerInspectEngineRegister("template_buffer", ALPROTO_TEMPLATE, SIG_FLAG_TOCLIENT, DetectEngineInspectTemplateBuffer); diff --git a/src/detect-tls-cert-issuer.c b/src/detect-tls-cert-issuer.c index f3fa104da8..5928e442c0 100644 --- a/src/detect-tls-cert-issuer.c +++ b/src/detect-tls-cert-issuer.c @@ -77,7 +77,7 @@ void DetectTlsIssuerRegister(void) DetectAppLayerMpmRegister("tls_cert_issuer", SIG_FLAG_TOCLIENT, 2, PrefilterTxTlsIssuerRegister); - DetectAppLayerInspectEngineRegister2("tls_cert_issuer", + DetectAppLayerInspectEngineRegister("tls_cert_issuer", ALPROTO_TLS, SIG_FLAG_TOCLIENT, DetectEngineInspectTlsIssuer); diff --git a/src/detect-tls-cert-subject.c b/src/detect-tls-cert-subject.c index 33d4d51161..8c4936bbd3 100644 --- a/src/detect-tls-cert-subject.c +++ b/src/detect-tls-cert-subject.c @@ -77,7 +77,7 @@ void DetectTlsSubjectRegister(void) DetectAppLayerMpmRegister("tls_cert_subject", SIG_FLAG_TOCLIENT, 2, PrefilterTxTlsSubjectRegister); - DetectAppLayerInspectEngineRegister2("tls_cert_subject", + DetectAppLayerInspectEngineRegister("tls_cert_subject", ALPROTO_TLS, SIG_FLAG_TOCLIENT, DetectEngineInspectTlsSubject); diff --git a/src/detect-tls-cert-validity.c b/src/detect-tls-cert-validity.c index 510a6ca50c..2a868566d5 100644 --- a/src/detect-tls-cert-validity.c +++ b/src/detect-tls-cert-validity.c @@ -120,7 +120,7 @@ void DetectTlsValidityRegister (void) DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); - DetectAppLayerInspectEngineRegister2("tls_validity", + DetectAppLayerInspectEngineRegister("tls_validity", ALPROTO_TLS, SIG_FLAG_TOCLIENT, DetectEngineInspectTlsValidity); diff --git a/src/detect-tls-sni.c b/src/detect-tls-sni.c index 07c71f49c1..8d3f8333f2 100644 --- a/src/detect-tls-sni.c +++ b/src/detect-tls-sni.c @@ -77,7 +77,7 @@ void DetectTlsSniRegister(void) DetectAppLayerMpmRegister("tls_sni", SIG_FLAG_TOSERVER, 2, PrefilterTxTlsSniRegister); - DetectAppLayerInspectEngineRegister2("tls_sni", + DetectAppLayerInspectEngineRegister("tls_sni", ALPROTO_TLS, SIG_FLAG_TOSERVER, DetectEngineInspectTlsSni);